CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS
Percentile
51.5%
Any user can edit his own profile and inject code which is going to be executed with programming right.
Steps to reproduce:
{{cache id="userProfile"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/cache}}
The first name appears as interpreted “Hello from groovy
” instead of the expected fully escaped “{{cache id="userProfile"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/cache}}
”.
The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field.
The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.
There are no other workarounds than upgrading XWiki or patching the xwiki-commons-xml JAR file.
If you have any questions or comments about this advisory: